CVE-2026-5051
Received Received - Intake

Audit Device Validation Bypass in HashiCorp Vault

Publication date: 2026-07-01

Last updated on: 2026-07-01

Assigner: HashiCorp Inc.

Description
HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability (CVE-2026-5051) is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-01
Last Modified
2026-07-01
Generated
2026-07-02
AI Q&A
2026-07-01
EPSS Evaluated
N/A
NVD
CVE-2026-5051
EUVD
EUVD-2026-41098

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
hashicorp vault to 2.0.1 (exc)
hashicorp vault_enterprise to 2.0.1 (exc)
hashicorp vault *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-5051 is a security vulnerability in HashiCorp Vault and Vault Enterprise versions prior to 2.0.1. The issue arises because the audit device validation logic did not consistently enforce protections on the plugin directory when the legacy file audit path option was used. This inconsistency could allow audit logs to be written into sensitive plugin directories, potentially bypassing intended security controls.

Impact Analysis

This vulnerability can impact you by allowing unauthorized or unintended writes of audit logs into sensitive plugin directories. Such a guard bypass could lead to potential security risks, including tampering with audit logs or affecting the integrity of plugin files. This may undermine the reliability of audit trails and could be exploited by attackers with sufficient permissions.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade HashiCorp Vault or Vault Enterprise to one of the fixed versions: 2.0.1, 1.21.6, 1.20.11, or 1.19.17.

Additionally, restrict audit device management permissions to trusted operators to reduce the risk of exploitation.

Compliance Impact

The vulnerability in HashiCorp Vault prior to the fixed versions involves inconsistent enforcement of plugin directory protections when using the legacy file audit path option. This could allow audit logs to be written into sensitive plugin directories, potentially compromising the integrity and confidentiality of audit data.

Since audit logs are critical for compliance with standards such as GDPR and HIPAA, which require secure and tamper-evident logging of access and operations, this vulnerability could negatively impact an organization's ability to meet these regulatory requirements.

To mitigate this risk and maintain compliance, it is recommended to upgrade to the fixed versions and restrict audit device management permissions to trusted operators.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-5051. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart